How to Collect Microsoft Teams Audit Logs | Office 365 Management API

# Get OAuth token
TOKEN=$(curl -X POST "https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/token" \
  -d "client_id={CLIENT_ID}&client_secret={CLIENT_SECRET}&scope=https://manage.office.com/.default&grant_type=client_credentials" \
  | jq -r '.access_token')

# Start General subscription (includes Teams)
curl -X POST "https://manage.office.com/api/v1.0/{TENANT_ID}/activity/feed/subscriptions/start?contentType=Audit.General&PublisherIdentifier={TENANT_ID}" \
  -H "Authorization: Bearer ${TOKEN}"

nodes:
- name: teams_audit_logs
  type: http_pull_input
  endpoint: https://manage.office.com/api/v1.0/YOUR_TENANT_ID/activity/feed/subscriptions/content
  method: GET
  pull_interval: 5m

  authorization:
    strategy: oauth_client_credentials
    client_credentials:
      token_url: https://login.microsoftonline.com/YOUR_TENANT_ID/oauth2/v2.0/token
      client_id: YOUR_CLIENT_ID
      client_secret: YOUR_CLIENT_SECRET
      scopes:
        - https://manage.office.com/.default
      header_templates:
        - header: Authorization
          value: Bearer $ACCESS_TOKEN

  parameters:
    - name: contentType
      value: Audit.General
    - name: PublisherIdentifier
      value: YOUR_TENANT_ID

  parameter_expressions:
    - name: startTime
      value_expression: FormatTime(Now() - Duration("6m"), "%Y-%m-%dT%H:%M:%SZ")
    - name: endTime
      value_expression: FormatTime(Now() - Duration("1m"), "%Y-%m-%dT%H:%M:%SZ")

  pagination:
    url_json_path: contentUri
    response_format: json
    max_parallel: 3
    inherit_auth: true
    error_strategy: continue

{
  "CreationTime": "2024-01-01T10:00:00",
  "Id": "teams-audit-guid",
  "Operation": "MemberAdded",
  "OrganizationId": "org-guid",
  "RecordType": 25,
  "UserType": 0,
  "Workload": "MicrosoftTeams",
  "UserId": "admin@company.com",
  "TeamName": "Engineering Team",
  "TeamGuid": "team-guid",
  "Members": [
    {
      "UPN": "newmember@company.com",
      "Role": "Member",
      "DisplayName": "New Member"
    }
  ],
  "AddOnName": null,
  "CommunicationType": "Team"
}

{
  "CreationTime": "2024-01-01T14:00:00",
  "Id": "meeting-audit-guid",
  "Operation": "MeetingParticipantJoined",
  "Workload": "MicrosoftTeams",
  "UserId": "user@company.com",
  "MeetingId": "meeting-guid",
  "MeetingType": "Scheduled",
  "Attendees": [
    {
      "UPN": "user@company.com",
      "Role": "Presenter"
    }
  ],
  "CommunicationType": "GroupCall"
}

# Filter criteria:
# Workload == "MicrosoftTeams"
# RecordType == 25 (Teams operations)